The Hardware Wallet Attack Nobody Saw Coming
Coldcard Mk3 users need to act today. Trezor, Ledger, and other wallets are unaffected — but this changes how everyone should think about cold storage.
THIS WEEK’S TOP STORIES
Coldcard Cold Storage Hack: What Happened and What To Do
This morning, 594 Bitcoin, roughly $38 million, was drained from 500 wallets in 15 minutes. Not from an exchange. Not from a hot wallet. From cold storage hardware wallets. The devices we’ve told people are the safest place to hold crypto.
Hours later, Coinkite published a security advisory confirming what on-chain analysts were already piecing together: the Coldcard Mk3 may have a flaw in the random number generator used during seed generation. If your seed was created on a Mk3 running firmware 4.0.1 through 5.0.3 — which covers almost every Mk3 in circulation after March 2021 — your private keys could potentially be recomputed by an attacker without ever touching your device. 1,324 UTXOs swept across 4 consecutive blocks in an automated attack. And not one multisig wallet was touched.
If you use any Coldcard device, read the official advisory now and follow Coinkite’s guidance: blog.coinkite.com/coldcard-mk3-seed-generation-warning
I’ve been covering crypto for over 12 years. Hardware wallet RNG vulnerabilities being actively exploited in real time is a different kind of alarm bell because this is the layer people trust most. The attack was surgical. Automated. And it only hit single-sig wallets.
The lesson for everyone, regardless of which wallet you use: multisig and a BIP-39 passphrase are not optional extras. They are the standard. Today proved it.
IF YOU NEED A SECURE COLD WALLET
I’ve used Trezor as my personal hardware wallet for years. Trezor’s open-source firmware has never had a confirmed remote hack in over a decade, and today’s news is a reminder that that kind of transparency matters. Note: We are affiliates of Trezor for years and we only promote products that we actually use.
If you’re migrating off a Mk3 or have been putting off getting a proper cold wallet:
Trezor Safe 3 ($47) — Entry level, all the essentials. Get it →
Trezor Safe 5 ($103) — Touchscreen, mid-range sweet spot. Get it →
Trezor Safe 7 ($224) — Flagship, quantum-ready. Get it →
Read our full 2026 Trezor review →
Not your keys. Not your crypto.
Wall Street’s Biggest Blow-Up of 2026 (And Why Crypto Didn’t Follow)
Leopold Aschenbrenner’s Situational Awareness fund went from a 1,000%+ return streak to a forced liquidation in six trading days. Running 4x gross leverage on AI infrastructure stocks, the fund’s core holdings — Nebius, SanDisk, Micron, and CoreWeave — fell 27–54% in July. Goldman Sachs, JPMorgan, and Bank of America all issued margin calls simultaneously. The entire public equities book — roughly $16 billion at its peak — was sold in a single block trade to Ken Griffin’s Citadel before the market opened on July 30. What remains at Situational Awareness is a $5 billion private stake in Anthropic.
The crypto angle: while the Philadelphia Semiconductor Index fell 28.6% from its June peak and AI-linked equities got crushed, Bitcoin held $63,000–$64,000. Crypto stocks were among the top gainers Monday as capital rotated out of chip and AI names. This is the second time in a week crypto has held through a sharp AI trade unwind — and it’s a signal worth watching. Whether that decoupling holds as rate hike fears, a closed Strait of Hormuz, and elevated energy costs persist is the key question heading into August.
The Clarity Act: Down to the Wire
As of today, the Digital Asset Market Clarity Act has cleared the House and the Senate Banking Committee, but has no floor vote, no cloture motion, and no date on the calendar. Senate Majority Leader Thune has told reporters he does not expect the bill to reach the floor before the August 7 recess. Polymarket odds fell to 28% on July 30.
The one piece of movement: Senators Thom Tillis and Ruben Gallego have finalized a compromise on the ethics provision — the sticking point that’s kept most Democrats from committing a yes vote. Whether that compromise holds together enough to clear 60 votes before the recess deadline is still unclear. Miss August 7 and the next realistic window is likely 2027, after midterms and a crowded fall calendar.
🔗 SPONSORED BY XYO NETWORK
The Original DePIN Protocol — Now with Its Own Layer One
10M+ nodes. A decade of proof-of-work. XYO’s Layer One is built for high-volume data, AI infrastructure, and real-world asset tokenization — with dual tokens $XYO and $XL1. XYO was also recently listed on Crypto.com, expanding visibility across the DePIN and data infrastructure ecosystem.
🔥 SIGNAL RECAP
⭐⭐⭐ BREAKING: Coldcard Mk3 security advisory — 594 BTC ($38M) drained this morning. RNG flaw in seed generation on firmware 4.0.1–5.0.3. Mk4, Mk5, Q, Trezor, Ledger unaffected. BIP-39 passphrase users at minimal risk. Act now if you’re on a Mk3. Full advisory →
⭐⭐⭐ Leopold Aschenbrenner’s AI fund sold its entire public book to Citadel under forced margin calls. 4x leverage turned a July AI drawdown into a $16B liquidation in 6 days. Crypto held $63K–$64K through the unwind — decoupling from AI equities for the second week running.
⭐⭐⭐ CLARITY Act down to the wire — August 7 recess deadline. Polymarket at 28%. Tillis/Gallego ethics compromise finalized as of July 29. No floor vote scheduled. Miss the deadline and the next window is likely 2027.
⭐⭐ Coming Monday: Fresh ZIGChain interview — the $5B RWA pipeline, Shariah-certified private credit, and why ZIG 2.0’s buyback model is different. Plus: the crypto lawyer who knows the three best countries to incorporate your crypto company. Full BTC and ETH technical analysis. All in Issue #14.
⭐⭐⭐ Crypto Clarity Act: every major voice is now on record. Jack Dorsey’s Block, Coinbase CEO Brian Armstrong, JPMorgan, and Treasury Secretary Bessent all called on the Senate to pass the bill this week. JPMorgan warned: “The longer the approval is postponed, the greater the threat to crypto markets.” Senate Democrats remain the holdout.
⭐⭐⭐ Circle/USDC granted New York trust charter. The NY Department of Financial Services officially granted Circle a trust charter — a meaningful regulatory milestone for stablecoin legitimacy in the US.
⭐⭐⭐ JPMorgan, Citi, UBS complete tokenized cross-border payment test — average settlement: 80 seconds. Institutional blockchain adoption is no longer theoretical. This is the infrastructure layer being built in real time.
⭐⭐ US economy grew just 1.5% in Q2 2026, below expectations. Macro backdrop remains soft. Bitcoin’s relative stability through this and the AI equity unwind continues to make the decoupling case.
⭐⭐ El Salvador’s Bukele: “We never escaped the 2008 financial crisis — we just shifted the pain.” A quotable framing of the macro thesis that underpins the Bitcoin argument. Worth watching as a narrative signal.
⭐⭐ Japan and South Korea both intervened in currency markets this week. Japan bought yen after it hit a 40-year low against the dollar. South Korea sold dollars to strengthen the won. Global fiat stress is real and accelerating.
When $38 million disappears from cold storage in 25 minutes, people need context, not panic. When the Clarity Act hangs by a thread and the biggest names in crypto are all weighing in on the same day, you need someone cutting through the noise. That’s what we’re here for. Take it seriously, do your homework, and don’t make rushed decisions. We’ll be back Monday with the ZIGChain interview, full BTC and ETH technical analysis, and whatever the market throws at us over the weekend.
Stay sharp.
Ashton Addison
CEO, Crypto Coin Show
📌 QUICK LINKS
© 2026 Crypto Coin Show.
This publication is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. Investments in cryptocurrencies involve significant risk including loss of capital. Always conduct your own research and consult a qualified financial advisor before making investment decisions.